5.4. Securing access to the X Window System
Today, X terminals are used by more and more companies where one server is needed for a lot of workstations. This can be dangerous, because you need to allow the file server to connect to the clients (X server from the X point of view. X switches the definition of client and server). If you follow the (very bad) suggestion of many docs, you type xhost + on your machine. This allows any X client to connect to your system. For slightly better security, you can use the command xhost +hostname instead to only allow access from specific hosts.
A much more secure solution, though, is to use ssh to tunnel X and encrypt the whole session. This is done automatically when you ssh to another machine. For this to work, you have to configure both the ssh client and the ssh server. On the ssh client, ForwardX11 should be set to yes in /etc/ssh/ssh_config. On the ssh server, X11Forwarding should be set to yes in /etc/ssh/sshd_config and the package xbase-clients should be installed because the ssh server uses /usr/X11R6/bin/xauth (/usr/bin/xauth on Debian unstable) when setting up the pseudo X display. In times of SSH, you should drop the xhost based access control completely.
For best security, if you do not need X access from other machines, switch off the binding on TCP port 6000 simply by typing:
$ startx -- -nolisten tcp
This is the default behavior in Xfree 4.1.0 (the Xserver provided in Debian 3.0 and 3.1). If you are running Xfree 3.3.6 (i.e. you have Debian 2.2 installed) you can edit
/etc/X11/xinit/xserverrc to have it something along the lines of:
#!/bin/sh
exec /usr/bin/X11/X -dpi 100 -nolisten tcp
If you are using XDM set
/etc/X11/xdm/Xservers to:
:0 local /usr/bin/X11/X vt7 -dpi 100 -nolisten tcp. If you are using Gdm make sure that the
DisallowTCP=true option is set in the
/etc/gdm/gdm.conf (which is the default in Debian). This will basically append
-nolisten tcp to every X command line
.
You can also set the default's system timeout for
xscreensaver locks. Even if the user can override it, you should edit the
/etc/X11/app-defaults/XScreenSaver configuration file and change the lock line:
*lock: False
(which is the default in Debian) to:
*lock: True
FIXME: Add information on how to disable the screensavers which show the user desktop (which might have sensitive information).
FIXME: Add info on thread of debian-security on how to change config files of XFree 3.3.6 to do this.
5.4.1. Check your display manager
If you only want to have a display manager installed for local usage (having a nice graphical login, that is), make sure the XDMCP (X Display Manager Control Protocol) stuff is disabled. In XDM you can do this with this line in
/etc/X11/xdm/xdm-config:
DisplayManager.requestPort: 0
For GDM there should be in your gdm.conf:
[xdmcp]
Enable=false
Normally, all display managers are configured not to start XDMCP services per default in Debian.
